With server-side sessions, the browser receives a session identifier in a cookie. The server stores the corresponding session state in a session store.

Important cookie attributes include Secure, HttpOnly, SameSite, Domain, Path, and expiration controls.

HttpOnly prevents JavaScript from reading the cookie. Secure restricts transmission to HTTPS. SameSite controls cross-site cookie behavior and helps mitigate CSRF in appropriate configurations.

Access tokens are generally short-lived credentials used to access APIs. Refresh tokens are longer-lived credentials used to obtain new access tokens.

Short access-token lifetimes reduce the impact of token theft. Refresh tokens require stronger protection and often use rotation and reuse detection.

A secure token architecture defines expiration, audience, issuer, scopes, revocation strategy, rotation behavior, and storage.

Logout Is Not Always Token Deletion

With purely self-contained JWT access tokens, the server may not have a central record that can instantly invalidate a token. Logout therefore requires an explicit strategy.

Possible approaches include short-lived access tokens, refresh-token revocation, token rotation, deny lists for high-risk scenarios, session stores, or opaque tokens with server-side introspection.

Security architecture should consider stolen tokens, password changes, account disablement, administrator revocation, device logout, and credential rotation.